Vulnerabilities Hub

Path: /vulnerabilities · Sidebar: Findings → Vulnerabilities

This is the central place where issues from every source - DAST, SAST, SCA, containers, IaC, secrets and imports - converge as unified, deduplicated Vulnerabilities and where you triage them.

Cross-tool deduplication

apPosture computes a source-aware fingerprint for each finding and merges those that describe the same real issue into one vulnerability. So if SAST and DAST both flag the same SQL injection, you see one entry carrying both pieces of evidence - not two tickets.

The list

• Filters - severity, status, source, application, KEV, reachability, exploit status, date.
• KPI strip - open, exploitable, SLA-breached counts.
• Severity breakdown and risk scoring sort the most important issues to the top.

Triage workflow

Open a vulnerability and move it through its lifecycle:

New → Triaged → Confirmed → In progress → Resolved → Verified → Closed
                   └── False positive
                   └── Risk accepted

For each vulnerability you can:

1. Set status and assign an owner.
2. Mark false positive - suppresses it and teaches future scans (see Mutes).
3. Accept risk - record a justified exception with an expiry.
4. Create a ticket / notify the owner.
5. Review the SLA deadline derived from severity.

Vulnerability detail

Path: /vulnerabilities/[id]

The detail page shows:

• Merged evidence from every contributing source/finding.
• Proof-of-exploit when exploitability was proven (the strongest priority signal).
• CWE/OWASP mapping, CVSS, EPSS, KEV flag, reachability.
• Remediation guidance and references.
• History - status changes and correlation across assessments.

Triage by truth, not volume

Sort by exploit confirmed and KEV first. A proven-exploitable issue outranks a pile of theoretical highs. The Priorities page automates exactly this ranking.